CVE-2025-43866: Vantage6 Server JWT secret not cryptographically secure
Impact The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent
Patches No
Workarounds You may define JWT secret key in the server configuration file
Other sources
vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This vulnerability is fixed in 4.11.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-43866?
The severity of CVE-2025-43866 is critical due to the use of a predictable JWT secret key that compromises security.
How do I fix CVE-2025-43866?
To fix CVE-2025-43866, manually define a cryptographically secure JWT secret key in the vantage6 server configuration.
What software versions are affected by CVE-2025-43866?
CVE-2025-43866 affects versions of vantage6-server up to 4.11.0 inclusive.
Can I still use the default settings with CVE-2025-43866?
Using the default settings with CVE-2025-43866 is highly discouraged as it exposes your application to vulnerabilities.
What impact does CVE-2025-43866 have on my application?
CVE-2025-43866 may allow attackers to predict the JWT secret key, leading to unauthorized access or token forgery.